crash in rule_tree::pop_from_free_list

[bholley]

Loading http://spectrum.ieee.org/video/geek-life/tools-toys/this-water-jet-cutter-can-slice-through-anything-steel-glass-or-steak in Servo, I hit the following:

https://pastebin.mozilla.org/8928296

The stack from lldb is a bit more illuminating: https://pastebin.mozilla.org/8928301

Basically, we're finalizing the Window on the script thread, and then we end up in alloc::arc::{{impl}}::drop<std::sync::mutex::Mutexlayout::query::LayoutThreadData>

That seems to suggest that we're dropping an Arc to layout data on the script thread, which seems problematic.

LayoutRPCImpl looks questionable:

servo/components/layout/query.rs

Line 85 in f48b3fe

pub struct LayoutRPCImpl(pub Arc<Mutex<LayoutThreadData>>);

And we send it over to the layout thread here:

servo/components/layout_thread/lib.rs

Line 629 in 9467fbe

response_chan.send(box LayoutRPCImpl(self.rw_data.clone()) as

We've got an Arc<Mutex>, so from the Type system's perspective this is all kosher. Do we need to mark StrongRuleNode as non-Send? Or should we remove the assertion?

CC @emilio @jdm

[emilio]

Ok, I was worried for a second this could be dropping node's data inside script.

We're finalizing the window after layout, which I think it's... not quite the expected, and probably should be investigated a bit more.

Probably the assertion should be removed, but I think it's not quite the expected thing in any case.

[jdm]

I'll defer to people like @emilio and @pcwalton here.

[nox]

Original page doesn't panic anymore, and #14278 is supposed to have fixed the problem. Closing this.